opensuse/freetype2&distro=openSUSE Tumbleweed

Vulnerabilities (63)

• CVE-2026-23865MedMar 2, 2026
  affected < 2.14.2-1.1fixed 2.14.2-1.1

  An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.

• CVE-2022-27406HigApr 22, 2022
  affected < 2.12.1-3.1fixed 2.12.1-3.1

  FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.

• CVE-2022-27404CriApr 22, 2022
  affected < 2.12.1-3.1fixed 2.12.1-3.1

  FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.

• CVE-2018-25032HigMar 25, 2022
  affected < 2.12.1-1.1fixed 2.12.1-1.1

  zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

• CVE-2020-15999CriKEVNov 3, 2020
  affected < 2.11.0-1.2fixed 2.11.0-1.2

  Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

• CVE-2018-6942MedFeb 13, 2018
  affected < 2.11.0-1.2fixed 2.11.0-1.2

  An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lead to DoS via a crafted font file.

• CVE-2017-8105CriApr 24, 2017
  affected < 2.11.0-1.2fixed 2.11.0-1.2

  FreeType 2 before 2017-03-24 has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.

• CVE-2014-9675Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font.

• CVE-2014-9674Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly hav

• CVE-2014-9673Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font.

• CVE-2014-9672Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  Array index error in the parse_fond function in base/ftmac.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (out-of-bounds read) or obtain sensitive information from process memory via a crafted FOND resource in a Mac font file.

• CVE-2014-9671Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented.

• CVE-2014-9670Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative va

• CVE-2014-9669Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table.

• CVE-2014-9668Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  The woff_open_font function in sfnt/sfobjs.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting length values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecif

• CVE-2014-9667Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table.

• CVE-2014-9666Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspeci

• CVE-2014-9665Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  The Load_SBit_Png function in sfnt/pngshim.c in FreeType before 2.5.4 does not restrict the rows and pitch values of PNG data, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact by

• CVE-2014-9664Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1

• CVE-2014-9663Feb 8, 2015
  affected < 2.7-1.1fixed 2.7-1.1

  The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact